Microsoft MS-102 Security Exposure Management And Microsoft Secure Score Practice Test

Practice Exams:

View All

Microsoft MS-102 Security Exposure Management And Microsoft Secure Score Practice Test

MS-102 skills 3.1 | 28 original questions

This MS-102 practice set focuses on security exposure management and microsoft secure score through original scenario-based questions aligned to Microsoft skills measured as of April 28, 2026. Use the full ExamSnap MS-102 collection for practice across all four current skill areas. For broader exam preparation, review the Microsoft MS-102 Exam Dumps page.

Instructions: Select the best answer for each question. Review the rationale after answering. Each distractor includes a brief explanation of why it is not the strongest fit for the stated scenario.

Question 1

Tailspin Toys is migrating a business process to Microsoft 365 and wants the narrowest supported solution. A post-incident action item requires the tenant to identify prioritized security configuration improvements and measure progress over time. The service desk has 81 related tickets from 4 business units, so the team wants a targeted fix. The architecture board will reject a choice that solves a different problem from the one stated. Which approach most directly addresses the requirement?

Review Microsoft Secure Score improvement actions
Create a Microsoft Defender for Office 365 alert policy
Secure the compromised account before removing the sending restriction
Review exposed devices for the recommendation before scheduling the fix
Filter the Defender for Cloud Apps activity log by user, IP address, activity, or application

Correct answer: A

Why: Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress. It directly addresses the stated requirement.

Option review:

A: Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress. It directly addresses the stated requirement.

B: Alert policies define the conditions and notification behavior for security events that should create administrator alerts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Unblocking without correcting the compromised credentials or malicious behavior risks immediate re-abuse of the account. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: The activity log supports rich filtering so analysts can isolate the user, application, object, location, or action associated with suspicious cloud behavior. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q001: Review Microsoft Secure Score improvement actions – Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress.

Question 2

Wingtip Services is troubleshooting a Microsoft 365 behavior that affects a limited but important user population. The administrator must choose between several Microsoft 365 controls. Only one directly meets the documented need to understand how assets, identities, and weaknesses combine into exploitable exposure. The architecture board will reject a choice that solves a different problem from the one stated. The service desk has 7 related tickets from 17 business units, so the team wants a targeted fix. Which administrative choice should be recommended?

Create an activity policy in Defender for Cloud Apps with an alert
Use Microsoft Security Exposure Management to investigate exposure paths and initiatives
Mark the risky discovered app as unsanctioned and use supported enforcement integration where appropriate
Use Microsoft Defender XDR reports for trend and coverage analysis
Create a Microsoft Defender for Office 365 alert policy

Correct answer: B

Why: Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings. It directly addresses the stated requirement.

Option review:

A: Activity policies evaluate cloud activity criteria and can trigger alerts when matching events occur. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings. It directly addresses the stated requirement.

C: Unsanctioning identifies disallowed apps and can integrate with supported controls to help restrict their use. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Defender XDR reports summarize security posture, activity, and trends in ways that complement event-level investigations. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Alert policies define the conditions and notification behavior for security events that should create administrator alerts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q002: Use Microsoft Security Exposure Management to investigate exposure paths and initiatives – Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings.

Question 3

City Power & Light has completed a pilot and must now choose the production administration approach. A root-cause review has ruled out licensing and connectivity problems; the remaining need is to reduce the security risk represented by the most consequential exposed paths. The team will validate the change with 7 pilot groups before expanding it to 24 users. The response must address the cause described in the scenario rather than simply suppressing the symptom. Which action should the administrator take?

Configure a Safe Attachments policy
Review simulation results to identify users or techniques that need additional training
Prioritize remediation by exposure and business context rather than score alone
Prioritize the vulnerability recommendation with the highest risk and exposure impact
Create an activity policy in Defender for Cloud Apps with an alert

Correct answer: C

Why: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. It directly addresses the stated requirement.

Option review:

A: Safe Attachments provides additional protection against unknown malicious attachments beyond signature-based malware detection. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Simulation metrics show interaction patterns and training outcomes that can guide follow-up education and future campaign design. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. It directly addresses the stated requirement.

D: Defender Vulnerability Management combines vulnerability, threat, exposure, and asset context to help prioritize remediation rather than ranking by CVE count alone. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Activity policies evaluate cloud activity criteria and can trigger alerts when matching events occur. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q003: Prioritize remediation by exposure and business context rather than score alone – Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority.

Question 4

Southridge Video is migrating a business process to Microsoft 365 and wants the narrowest supported solution. The existing configuration works for normal operations but fails the new requirement to turn a recommended security improvement into a monitored remediation activity. The design should minimize manual per-user administration where a scoped central control exists. The affected scope contains 41 users across 20 administrative groups. Which action should the administrator take?

Connect Microsoft 365 to Microsoft Defender for Cloud Apps with the app connector
Integrate Defender for Endpoint signals with Cloud App Discovery when endpoints are the chosen visibility source
Investigate the incident in the Microsoft Defender portal
Assign and track improvement work from the Secure Score recommendation context
Configure a Safe Attachments policy

Correct answer: D

Why: Secure Score recommendations provide context for remediation and progress tracking instead of requiring administrators to infer actions from raw alert counts. It directly addresses the stated requirement.

Option review:

A: The Microsoft 365 app connector supplies supported activity and governance integration to Defender for Cloud Apps. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Defender for Endpoint integration can supply endpoint-based cloud app usage signals to Cloud App Discovery without requiring only perimeter firewall logs. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Defender XDR incidents aggregate related alerts and evidence across supported products, giving responders a coordinated investigation view. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Secure Score recommendations provide context for remediation and progress tracking instead of requiring administrators to infer actions from raw alert counts. It directly addresses the stated requirement.

E: Safe Attachments provides additional protection against unknown malicious attachments beyond signature-based malware detection. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q004: Assign and track improvement work from the Secure Score recommendation context – Secure Score recommendations provide context for remediation and progress tracking instead of requiring administrators to infer actions from raw alert counts.

Question 5

An incident review at A. Datum Manufacturing produces a single administrative requirement for the messaging administrator. A controlled pilot must demonstrate how to track a coordinated set of exposure-management recommendations against an organizational goal. The response must address the cause described in the scenario rather than simply suppressing the symptom. The service desk has 58 related tickets from 10 business units, so the team wants a targeted fix. Which administrative choice should be recommended?

Correlate a suspicious indicator with Defender Threat Intelligence before blocking it broadly
Use quarantine and remediation actions for confirmed malicious messages
Configure Defender for Endpoint settings in the Microsoft Defender portal
Connect Microsoft 365 to Microsoft Defender for Cloud Apps with the app connector
Use exposure initiatives to measure progress toward a defined security objective

Correct answer: E

Why: Exposure initiatives organize related recommendations around measurable security objectives, making them better suited than isolated alerts for posture improvement programs. It directly addresses the stated requirement.

Option review:

A: Threat-intelligence context can reduce false assumptions and reveal related infrastructure before a high-impact blocking decision is made. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Quarantine and message remediation actions remove or restrict access to malicious content without relying on users to delete messages manually. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Endpoint settings in the Defender portal govern service features and integrations rather than requiring per-device manual changes for every capability. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: The Microsoft 365 app connector supplies supported activity and governance integration to Defender for Cloud Apps. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Exposure initiatives organize related recommendations around measurable security objectives, making them better suited than isolated alerts for posture improvement programs. It directly addresses the stated requirement.

Learning point: MS102-T12-Q005: Use exposure initiatives to measure progress toward a defined security objective – Exposure initiatives organize related recommendations around measurable security objectives, making them better suited than isolated alerts for posture improvement programs.

Question 6

Fabrikam Health is standardizing administration after several teams used inconsistent procedures. The current workaround is too manual. The replacement should identify prioritized security configuration improvements and measure progress over time. The team will validate the change with 23 pilot groups before expanding it to 75 users. The response must address the cause described in the scenario rather than simply suppressing the symptom. What is the most appropriate next step?

Review Microsoft Secure Score improvement actions
Reassess the recommendation after remediation to verify exposure decreased
Pivot from a suspicious activity-log event to the related user or app context
Assign and track improvement work from the Secure Score recommendation context
Correlate a suspicious indicator with Defender Threat Intelligence before blocking it broadly

Correct answer: A

Option review:

A: Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress. It directly addresses the stated requirement.

B: Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Activity-log records are more useful when correlated with the involved user, app, IP, and adjacent events instead of reviewed as standalone lines. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Secure Score recommendations provide context for remediation and progress tracking instead of requiring administrators to infer actions from raw alert counts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Threat-intelligence context can reduce false assumptions and reveal related infrastructure before a high-impact blocking decision is made. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q006: Review Microsoft Secure Score improvement actions – Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress.

Question 7

During a tenant review at VanArsdel Media, the hybrid identity engineer identifies one unresolved requirement. The current workaround is too manual. The replacement should understand how assets, identities, and weaknesses combine into exploitable exposure. The initial rollout covers 13 locations and approximately 920 managed identities or devices. Existing workload settings should remain unchanged unless the requirement specifically depends on them. What is the most appropriate next step?

Drill from a Defender XDR report finding into the underlying security data
Use Microsoft Security Exposure Management to investigate exposure paths and initiatives
Tune alert policy thresholds or recipients instead of weakening threat protection
Use the supported Defender for Endpoint onboarding method for the device-management platform
Reassess the recommendation after remediation to verify exposure decreased

Correct answer: B

Option review:

A: Reports identify patterns or issues; responders should use the related detailed records or incidents to determine the cause and required action. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Alerting and threat protection are separate concerns; changing the alert policy can reduce notification noise without disabling the protection itself. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Defender for Endpoint provides multiple supported onboarding methods; choosing one aligned to the management platform improves consistency and verification. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q007: Use Microsoft Security Exposure Management to investigate exposure paths and initiatives – Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings.

Question 8

Lucerne Publishing is troubleshooting a Microsoft 365 behavior that affects a limited but important user population. The current workaround is too manual. The replacement should reduce the security risk represented by the most consequential exposed paths. The service desk has 18 related tickets from 3 business units, so the team wants a targeted fix. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. Which Microsoft 365 or Microsoft Entra capability is the best fit?

Create and track a remediation activity from the vulnerability recommendation
Use an anomaly detection or app discovery policy when the requirement is behavior- or discovery-driven
Prioritize remediation by exposure and business context rather than score alone
Review Microsoft Secure Score improvement actions
Drill from a Defender XDR report finding into the underlying security data

Correct answer: C

Option review:

A: Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Defender for Cloud Apps offers policy types tailored to activity anomalies and discovered-app governance scenarios. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. It directly addresses the stated requirement.

D: Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Reports identify patterns or issues; responders should use the related detailed records or incidents to determine the cause and required action. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q008: Prioritize remediation by exposure and business context rather than score alone – Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority.

Question 9

During a tenant review at Tailspin Toys, the identity administrator identifies one unresolved requirement. The administrator is comparing native Microsoft controls after documenting a requirement to turn a recommended security improvement into a monitored remediation activity. The team will validate the change with 16 pilot groups before expanding it to 35 users. The design should minimize manual per-user administration where a scoped central control exists. Which Microsoft 365 or Microsoft Entra capability is the best fit?

Use advanced hunting with KQL
Use preset security policies when a standardized Microsoft-recommended protection baseline meets the requirement
Review the restricted entities page for the blocked user
Assign and track improvement work from the Secure Score recommendation context
Create and track a remediation activity from the vulnerability recommendation

Correct answer: D

Option review:

A: Advanced hunting supports flexible KQL queries across Defender XDR schema tables for proactive or investigation-driven searches. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Preset security policies bundle recommended configurations and can accelerate deployment of Standard or Strict protection baselines. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Restricted entities identifies users or other entities blocked because of suspicious or abusive sending behavior and supports controlled remediation. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q009: Assign and track improvement work from the Secure Score recommendation context – Secure Score recommendations provide context for remediation and progress tracking instead of requiring administrators to infer actions from raw alert counts.

Question 10

VanArsdel Media is troubleshooting a Microsoft 365 behavior that affects a limited but important user population. Audit evidence shows that the current process cannot reliably track a coordinated set of exposure-management recommendations against an organizational goal. The architecture board will reject a choice that solves a different problem from the one stated. The control owner requires a review after 52 days and evidence from 6 representative cases. Which Microsoft 365 or Microsoft Entra capability is the best fit?

Use device groups or supported scoped settings when different endpoint populations require different treatment
Validate the app connector status and granted permissions
Review the discovered app risk score and usage before sanctioning or unsanctioning it
Use advanced hunting with KQL
Use exposure initiatives to measure progress toward a defined security objective

Correct answer: E

Option review:

A: Scoped endpoint administration helps align settings and response permissions to device populations and operational responsibilities. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: A connector that is disabled, unhealthy, or missing required permissions can prevent expected activity from appearing. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Cloud App Discovery provides app risk information and usage context that should inform governance decisions instead of blocking solely because an app is unfamiliar. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Advanced hunting supports flexible KQL queries across Defender XDR schema tables for proactive or investigation-driven searches. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q010: Use exposure initiatives to measure progress toward a defined security objective – Exposure initiatives organize related recommendations around measurable security objectives, making them better suited than isolated alerts for posture improvement programs.

Question 11

An incident review at Wingtip Services produces a single administrative requirement for the security operations analyst. The change advisory board wants the smallest supported control that can identify prioritized security configuration improvements and measure progress over time. The service desk has 69 related tickets from 19 business units, so the team wants a targeted fix. Existing workload settings should remain unchanged unless the requirement specifically depends on them. What is the most appropriate next step?

Review Microsoft Secure Score improvement actions
Use exposure initiatives to measure progress toward a defined security objective
Configure a Safe Links policy
Create an Attack Simulation Training campaign
Use device groups or supported scoped settings when different endpoint populations require different treatment

Correct answer: A

Option review:

A: Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress. It directly addresses the stated requirement.

B: Exposure initiatives organize related recommendations around measurable security objectives, making them better suited than isolated alerts for posture improvement programs. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Safe Links evaluates URLs and can block malicious destinations at click time, addressing link-based phishing threats. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Attack Simulation Training lets security teams run controlled simulations and associate training with the simulated attack experience. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Scoped endpoint administration helps align settings and response permissions to device populations and operational responsibilities. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q011: Review Microsoft Secure Score improvement actions – Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress.

Question 12

An incident review at Litware Financial produces a single administrative requirement for the hybrid identity engineer. The implementation review is focused on one outcome: understand how assets, identities, and weaknesses combine into exploitable exposure. The service desk has 86 related tickets from 9 business units, so the team wants a targeted fix. The team does not want to redesign unrelated workloads. What is the most appropriate next step?

Verify the device appears in Defender for Endpoint device inventory after onboarding
Use Microsoft Security Exposure Management to investigate exposure paths and initiatives
Use threat and exploit context when prioritizing two vulnerabilities with similar severity
Use Cloud App Discovery data from supported endpoint or network traffic sources
Use exposure initiatives to measure progress toward a defined security objective

Correct answer: B

Option review:

A: Successful script execution alone does not prove service connectivity; device inventory and sensor health provide evidence that onboarding completed. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Cloud App Discovery analyzes observed cloud traffic to identify applications and usage rather than relying only on an administrator-maintained application list. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q012: Use Microsoft Security Exposure Management to investigate exposure paths and initiatives – Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings.

Question 13

During a tenant review at Northwind Traders, the messaging administrator identifies one unresolved requirement. The implementation review is focused on one outcome: reduce the security risk represented by the most consequential exposed paths. The affected scope contains 12 users across 22 administrative groups. The team does not want to redesign unrelated workloads. Which control should the team use?

Use Microsoft Security Exposure Management to investigate exposure paths and initiatives
Use Microsoft Defender Threat Intelligence for threat actor and indicator context
Prioritize remediation by exposure and business context rather than score alone
Use Threat Explorer or Real-time detections to investigate the malicious message campaign
Verify the device appears in Defender for Endpoint device inventory after onboarding

Correct answer: C

Option review:

A: Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Defender Threat Intelligence provides intelligence context that helps analysts understand indicators and threat infrastructure beyond tenant telemetry alone. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. It directly addresses the stated requirement.

D: Defender for Office 365 investigation tools provide message-level campaign and detection details needed to scope and respond to email threats. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Successful script execution alone does not prove service connectivity; device inventory and sensor health provide evidence that onboarding completed. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q013: Prioritize remediation by exposure and business context rather than score alone – Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority.

Question 14

Fabrikam Health is standardizing administration after several teams used inconsistent procedures. The next migration wave is blocked until the team can turn a recommended security improvement into a monitored remediation activity. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. The control owner requires a review after 29 days and evidence from 12 representative cases. Which control should the team use?

Secure the compromised account before removing the sending restriction
Review exposed devices for the recommendation before scheduling the fix
Filter the Defender for Cloud Apps activity log by user, IP address, activity, or application
Assign and track improvement work from the Secure Score recommendation context
Use Microsoft Security Exposure Management to investigate exposure paths and initiatives

Correct answer: D

Option review:

A: Unblocking without correcting the compromised credentials or malicious behavior risks immediate re-abuse of the account. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: The activity log supports rich filtering so analysts can isolate the user, application, object, location, or action associated with suspicious cloud behavior. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q014: Assign and track improvement work from the Secure Score recommendation context – Secure Score recommendations provide context for remediation and progress tracking instead of requiring administrators to infer actions from raw alert counts.

Question 15

Graphic Design Institute is preparing a change requested by the governance lead. The change advisory board wants the smallest supported control that can track a coordinated set of exposure-management recommendations against an organizational goal. The initial rollout covers 2 locations and approximately 460 managed identities or devices. Existing workload settings should remain unchanged unless the requirement specifically depends on them. Which action should the administrator take?

Mark the risky discovered app as unsanctioned and use supported enforcement integration where appropriate
Use Microsoft Defender XDR reports for trend and coverage analysis
Create a Microsoft Defender for Office 365 alert policy
Secure the compromised account before removing the sending restriction
Use exposure initiatives to measure progress toward a defined security objective

Correct answer: E

Option review:

A: Unsanctioning identifies disallowed apps and can integrate with supported controls to help restrict their use. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Defender XDR reports summarize security posture, activity, and trends in ways that complement event-level investigations. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Alert policies define the conditions and notification behavior for security events that should create administrator alerts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Unblocking without correcting the compromised credentials or malicious behavior risks immediate re-abuse of the account. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q015: Use exposure initiatives to measure progress toward a defined security objective – Exposure initiatives organize related recommendations around measurable security objectives, making them better suited than isolated alerts for posture improvement programs.

Question 16

Woodgrove Bank is standardizing administration after several teams used inconsistent procedures. The change advisory board wants the smallest supported control that can identify prioritized security configuration improvements and measure progress over time. The affected scope contains 63 users across 15 administrative groups. The solution should use a native Microsoft control that matches the stated requirement. Which control should the team use?

Review Microsoft Secure Score improvement actions
Review simulation results to identify users or techniques that need additional training
Prioritize the vulnerability recommendation with the highest risk and exposure impact
Create an activity policy in Defender for Cloud Apps with an alert
Mark the risky discovered app as unsanctioned and use supported enforcement integration where appropriate

Correct answer: A

Option review:

A: Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress. It directly addresses the stated requirement.

C: Defender Vulnerability Management combines vulnerability, threat, exposure, and asset context to help prioritize remediation rather than ranking by CVE count alone. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Activity policies evaluate cloud activity criteria and can trigger alerts when matching events occur. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Unsanctioning identifies disallowed apps and can integrate with supported controls to help restrict their use. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q016: Review Microsoft Secure Score improvement actions – Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress.

Question 17

The governance lead at Lucerne Publishing is designing the next phase of the Microsoft 365 rollout. The implementation review is focused on one outcome: understand how assets, identities, and weaknesses combine into exploitable exposure. The control owner requires a review after 80 days and evidence from 5 representative cases. The team does not want to redesign unrelated workloads. Which action should the administrator take?

Integrate Defender for Endpoint signals with Cloud App Discovery when endpoints are the chosen visibility source
Use Microsoft Security Exposure Management to investigate exposure paths and initiatives
Investigate the incident in the Microsoft Defender portal
Configure a Safe Attachments policy
Review simulation results to identify users or techniques that need additional training

Correct answer: B

Option review:

A: Defender for Endpoint integration can supply endpoint-based cloud app usage signals to Cloud App Discovery without requiring only perimeter firewall logs. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Safe Attachments provides additional protection against unknown malicious attachments beyond signature-based malware detection. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Simulation metrics show interaction patterns and training outcomes that can guide follow-up education and future campaign design. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q017: Use Microsoft Security Exposure Management to investigate exposure paths and initiatives – Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings.

Question 18

Southridge Video is standardizing administration after several teams used inconsistent procedures. A root-cause review has ruled out licensing and connectivity problems; the remaining need is to reduce the security risk represented by the most consequential exposed paths. The team will validate the change with 18 pilot groups before expanding it to 6 users. The solution should use a native Microsoft control that matches the stated requirement. Which administrative choice should be recommended?

Use quarantine and remediation actions for confirmed malicious messages
Configure Defender for Endpoint settings in the Microsoft Defender portal
Prioritize remediation by exposure and business context rather than score alone
Connect Microsoft 365 to Microsoft Defender for Cloud Apps with the app connector
Integrate Defender for Endpoint signals with Cloud App Discovery when endpoints are the chosen visibility source

Correct answer: C

Option review:

A: Quarantine and message remediation actions remove or restrict access to malicious content without relying on users to delete messages manually. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Endpoint settings in the Defender portal govern service features and integrations rather than requiring per-device manual changes for every capability. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. It directly addresses the stated requirement.

E: Defender for Endpoint integration can supply endpoint-based cloud app usage signals to Cloud App Discovery without requiring only perimeter firewall logs. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q018: Prioritize remediation by exposure and business context rather than score alone – Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority.

Question 19

The operations team at Litware Financial needs to resolve an issue without granting broader permissions than necessary. The support team has reproduced the issue and narrowed it to this requirement: turn a recommended security improvement into a monitored remediation activity. The team will validate the change with 8 pilot groups before expanding it to 23 users. Existing workload settings should remain unchanged unless the requirement specifically depends on them. Which administrative choice should be recommended?

Pivot from a suspicious activity-log event to the related user or app context
Prioritize remediation by exposure and business context rather than score alone
Correlate a suspicious indicator with Defender Threat Intelligence before blocking it broadly
Assign and track improvement work from the Secure Score recommendation context
Use quarantine and remediation actions for confirmed malicious messages

Correct answer: D

Option review:

A: Activity-log records are more useful when correlated with the involved user, app, IP, and adjacent events instead of reviewed as standalone lines. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Threat-intelligence context can reduce false assumptions and reveal related infrastructure before a high-impact blocking decision is made. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Quarantine and message remediation actions remove or restrict access to malicious content without relying on users to delete messages manually. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q019: Assign and track improvement work from the Secure Score recommendation context – Secure Score recommendations provide context for remediation and progress tracking instead of requiring administrators to infer actions from raw alert counts.

Question 20

An incident review at Wingtip Services produces a single administrative requirement for the hybrid identity engineer. An internal assessment finds the control technically functional but unable to track a coordinated set of exposure-management recommendations against an organizational goal. The service desk has 40 related tickets from 21 business units, so the team wants a targeted fix. The organization wants a reversible rollout with measurable verification before broad enforcement. Which administrative choice should be recommended?

Tune alert policy thresholds or recipients instead of weakening threat protection
Use the supported Defender for Endpoint onboarding method for the device-management platform
Reassess the recommendation after remediation to verify exposure decreased
Pivot from a suspicious activity-log event to the related user or app context
Use exposure initiatives to measure progress toward a defined security objective

Correct answer: E

Option review:

A: Alerting and threat protection are separate concerns; changing the alert policy can reduce notification noise without disabling the protection itself. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Defender for Endpoint provides multiple supported onboarding methods; choosing one aligned to the management platform improves consistency and verification. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Closing a change ticket is not proof of risk reduction; Defender Vulnerability Management should reflect improved exposure after telemetry updates. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Activity-log records are more useful when correlated with the involved user, app, IP, and adjacent events instead of reviewed as standalone lines. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q020: Use exposure initiatives to measure progress toward a defined security objective – Exposure initiatives organize related recommendations around measurable security objectives, making them better suited than isolated alerts for posture improvement programs.

Question 21

Contoso Retail is migrating a business process to Microsoft 365 and wants the narrowest supported solution. The service owner wants a supportable design that will identify prioritized security configuration improvements and measure progress over time. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. The team will validate the change with 11 pilot groups before expanding it to 57 users. What should the administrator configure first?

Review Microsoft Secure Score improvement actions
Use an anomaly detection or app discovery policy when the requirement is behavior- or discovery-driven
Use Microsoft Security Exposure Management to investigate exposure paths and initiatives
Drill from a Defender XDR report finding into the underlying security data
Tune alert policy thresholds or recipients instead of weakening threat protection

Correct answer: A

Option review:

A: Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress. It directly addresses the stated requirement.

C: Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Reports identify patterns or issues; responders should use the related detailed records or incidents to determine the cause and required action. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Alerting and threat protection are separate concerns; changing the alert policy can reduce notification noise without disabling the protection itself. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q021: Review Microsoft Secure Score improvement actions – Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress.

Question 22

Graphic Design Institute is migrating a business process to Microsoft 365 and wants the narrowest supported solution. Administrators have confirmed the present design does not understand how assets, identities, and weaknesses combine into exploitable exposure. The control owner requires a review after 74 days and evidence from 24 representative cases. The response must address the cause described in the scenario rather than simply suppressing the symptom. Which Microsoft 365 or Microsoft Entra capability is the best fit?

Use preset security policies when a standardized Microsoft-recommended protection baseline meets the requirement
Use Microsoft Security Exposure Management to investigate exposure paths and initiatives
Review the restricted entities page for the blocked user
Create and track a remediation activity from the vulnerability recommendation
Use an anomaly detection or app discovery policy when the requirement is behavior- or discovery-driven

Correct answer: B

Option review:

A: Preset security policies bundle recommended configurations and can accelerate deployment of Standard or Strict protection baselines. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Remediation workflows let security teams request, track, and validate vulnerability fixes instead of treating recommendations as a static report. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Defender for Cloud Apps offers policy types tailored to activity anomalies and discovered-app governance scenarios. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q022: Use Microsoft Security Exposure Management to investigate exposure paths and initiatives – Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings.

Question 23

A quarterly control review at City Power & Light identifies a gap that must be corrected before the next audit. The next migration wave is blocked until the team can reduce the security risk represented by the most consequential exposed paths. The organization wants a reversible rollout with measurable verification before broad enforcement. The team will validate the change with 14 pilot groups before expanding it to 91 users. What is the most appropriate next step?

Validate the app connector status and granted permissions
Review the discovered app risk score and usage before sanctioning or unsanctioning it
Prioritize remediation by exposure and business context rather than score alone
Use advanced hunting with KQL
Use preset security policies when a standardized Microsoft-recommended protection baseline meets the requirement

Correct answer: C

Option review:

A: A connector that is disabled, unhealthy, or missing required permissions can prevent expected activity from appearing. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Cloud App Discovery provides app risk information and usage context that should inform governance decisions instead of blocking solely because an app is unfamiliar. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. It directly addresses the stated requirement.

E: Preset security policies bundle recommended configurations and can accelerate deployment of Standard or Strict protection baselines. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q023: Prioritize remediation by exposure and business context rather than score alone – Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority.

Question 24

Blue Yonder Airlines is preparing a change requested by the service desk lead. Audit evidence shows that the current process cannot reliably turn a recommended security improvement into a monitored remediation activity. The response must address the cause described in the scenario rather than simply suppressing the symptom. The team will validate the change with 4 pilot groups before expanding it to 17 users. Which approach most directly addresses the requirement?

Configure a Safe Links policy
Create an Attack Simulation Training campaign
Use device groups or supported scoped settings when different endpoint populations require different treatment
Assign and track improvement work from the Secure Score recommendation context
Validate the app connector status and granted permissions

Correct answer: D

Option review:

A: Safe Links evaluates URLs and can block malicious destinations at click time, addressing link-based phishing threats. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Attack Simulation Training lets security teams run controlled simulations and associate training with the simulated attack experience. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Scoped endpoint administration helps align settings and response permissions to device populations and operational responsibilities. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: A connector that is disabled, unhealthy, or missing required permissions can prevent expected activity from appearing. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q024: Assign and track improvement work from the Secure Score recommendation context – Secure Score recommendations provide context for remediation and progress tracking instead of requiring administrators to infer actions from raw alert counts.

Question 25

Trey Research is migrating a business process to Microsoft 365 and wants the narrowest supported solution. A controlled pilot must demonstrate how to track a coordinated set of exposure-management recommendations against an organizational goal. The response must address the cause described in the scenario rather than simply suppressing the symptom. The team will validate the change with 17 pilot groups before expanding it to 34 users. Which administrative choice should be recommended?

Use threat and exploit context when prioritizing two vulnerabilities with similar severity
Use Cloud App Discovery data from supported endpoint or network traffic sources
Assign and track improvement work from the Secure Score recommendation context
Configure a Safe Links policy
Use exposure initiatives to measure progress toward a defined security objective

Correct answer: E

Option review:

A: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Cloud App Discovery analyzes observed cloud traffic to identify applications and usage rather than relying only on an administrator-maintained application list. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Secure Score recommendations provide context for remediation and progress tracking instead of requiring administrators to infer actions from raw alert counts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Safe Links evaluates URLs and can block malicious destinations at click time, addressing link-based phishing threats. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q025: Use exposure initiatives to measure progress toward a defined security objective – Exposure initiatives organize related recommendations around measurable security objectives, making them better suited than isolated alerts for posture improvement programs.

Question 26

Alpine Ski House has completed a pilot and must now choose the production administration approach. The administrator is comparing native Microsoft controls after documenting a requirement to identify prioritized security configuration improvements and measure progress over time. The service desk has 51 related tickets from 7 business units, so the team wants a targeted fix. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. What should the administrator configure first?

Review Microsoft Secure Score improvement actions
Use Microsoft Defender Threat Intelligence for threat actor and indicator context
Use Threat Explorer or Real-time detections to investigate the malicious message campaign
Verify the device appears in Defender for Endpoint device inventory after onboarding
Use threat and exploit context when prioritizing two vulnerabilities with similar severity

Correct answer: A

Option review:

A: Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress. It directly addresses the stated requirement.

C: Defender for Office 365 investigation tools provide message-level campaign and detection details needed to scope and respond to email threats. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Successful script execution alone does not prove service connectivity; device inventory and sensor health provide evidence that onboarding completed. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Severity alone can be insufficient; active exploitation signals and organizational exposure provide stronger prioritization context. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q026: Review Microsoft Secure Score improvement actions – Secure Score surfaces recommended security actions and scoring so administrators can prioritize improvements and track security posture progress.

Question 27

Contoso Retail is migrating a business process to Microsoft 365 and wants the narrowest supported solution. A post-incident action item requires the tenant to understand how assets, identities, and weaknesses combine into exploitable exposure. The control owner requires a review after 68 days and evidence from 20 representative cases. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. Which approach most directly addresses the requirement?

Review exposed devices for the recommendation before scheduling the fix
Use Microsoft Security Exposure Management to investigate exposure paths and initiatives
Filter the Defender for Cloud Apps activity log by user, IP address, activity, or application
Prioritize remediation by exposure and business context rather than score alone
Use Microsoft Defender Threat Intelligence for threat actor and indicator context

Correct answer: B

Option review:

A: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Defender Threat Intelligence provides intelligence context that helps analysts understand indicators and threat infrastructure beyond tenant telemetry alone. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q027: Use Microsoft Security Exposure Management to investigate exposure paths and initiatives – Security Exposure Management helps connect exposure signals into attack paths and initiatives, supporting risk-based prioritization beyond isolated findings.

Question 28

The security administrator at A. Datum Manufacturing is designing the next phase of the Microsoft 365 rollout. A production change is approved only if it can reduce the security risk represented by the most consequential exposed paths. The change must be repeatable and supportable after the project team leaves. The initial rollout covers 10 locations and approximately 850 managed identities or devices. What should the administrator configure first?

Use Microsoft Defender XDR reports for trend and coverage analysis
Create a Microsoft Defender for Office 365 alert policy
Prioritize remediation by exposure and business context rather than score alone
Secure the compromised account before removing the sending restriction
Review exposed devices for the recommendation before scheduling the fix

Correct answer: C

Option review:

A: Defender XDR reports summarize security posture, activity, and trends in ways that complement event-level investigations. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority. It directly addresses the stated requirement.

E: Affected-device context helps scope remediation effort and identify whether critical or internet-exposed systems need accelerated treatment. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T12-Q028: Prioritize remediation by exposure and business context rather than score alone – Secure Score is a posture indicator, not a complete risk model; exposure, asset criticality, and exploitability should inform remediation priority.

Related posts: